I kept calling a role idempotent because main.yml included is_present.yml. The second run of install_harbor still changed the host. The dispatcher was fine. The present side was not.
roles/install_harbor/tasks/is_present.yml is the file I had to make boring.
It asserts harbor_container_runtime is podman or docker, and the compose provider is podman-compose or docker-compose. Then it slurps harbor_runtime_marker with failed_when: false. If that file exists and the decoded value is not the runtime in the inventory, the role stops. The fail message names remove_registry.yml and says the registry data is kept. I do not want a present run to be the thing that switches Podman and Docker under a live registry.
The data volume check is a findmnt. I set changed_when: false. Asking whether harbor_data_volume is its own filesystem is not a change. If harbor_data_require_mount is true and the target is not that path, the role stops and tells me to mount the disk. I got a dirty second run the first time I left that command at the default changed_when.
The version marker is the same slurp. harbor_installed_version is the decoded file, or empty. upgrade.yml is included only when that string is non-empty and not equal to harbor_version. A matching version skips the upgrade. That is the whole version check.
The installer unpack uses creates: {{ harbor_install_dir }}/install.sh. The second run does not unpack again.
harbor.yml is copied from harbor.yml.tmpl with force: false and mode 0600. Force false is the part I got wrong first. Force true rewrote the file every run, and the replace task after it then notified Reinstall harbor because the file no longer matched. The replace loop only touches the keys the release expects: hostname, the http and https ports, the certificate path, the private key path, the database password that still says root123, and data_volume. no_log: true. It notifies reinstall only when a line actually changes.
The admin password is a separate replace, and only when: not harbor_already_deployed. Harbor reads that password on first start. I seed it before the first deploy and I do not write it again. harbor_already_deployed comes from a stat of podman-compose.yml or docker-compose.yml in the install dir.
After the runtime-specific install and the optional cert sync, the role writes harbor_version_marker and harbor_runtime_marker. Those two files are what the next run reads. If they are missing, the next run thinks Harbor was never installed.
The second run I trust is the one that slurps the marker, skips the upgrade, skips the unpack, leaves harbor.yml alone, and does not seed the password. I do not have another definition of idempotent for this role.
The file is in github.com/noahfarshad/harbor-airgap-kit, roles/install_harbor/tasks/is_present.yml.